# OpenWAF Browsers

> Browser sandbox for AI agents. Real Google Chrome over CDP, hosted in the EU, declared to the sites it visits. Public beta, free within quota.

OpenWAF Browsers gives your AI agents a real browser in the cloud. You ask for one with an API call and get a CDP URL for Playwright, Puppeteer or the Playwright MCP server, and a live view URL for a person. Each browser runs in its own container in Germany, and every byte it sends goes out through a filtering, logging egress proxy.

## Status

**Public beta, free within quota, subject to approval.** An operator turns OpenWAF Browsers on for each organization. During the beta it is free within the [monthly quota](https://developers.openwaf.dev/browsers/limits/): 20 browser-hours and 5 GB of egress per organization. There is no paid plan yet. See [how to get access](#get-access).

## What you get

- **Real Google Chrome**, as shipped, headful, with its own sandbox on. No patched build and no headless mode.
- **CDP for any client.** `cdpUrl` is a browser-level DevTools WebSocket: `chromium.connectOverCDP()` in Playwright, `puppeteer.connect({browserWSEndpoint})` in Puppeteer, or `npx @playwright/mcp@latest --cdp-endpoint <cdpUrl>` for an MCP assistant.
- **Live view.** `liveUrl` opens the browser's screen in any web browser. A person can watch, or take over for a login, a 2FA prompt or a CAPTCHA.
- **Recordings.** Start a browser with `"recording": true` and get an MP4 of the session with its downloads.
- **Profiles.** A profile keeps cookies and logins between browsers. One browser uses a profile at a time.
- **Egress proxy.** All traffic leaves through a proxy that only allows ports 80 and 443, always refuses private, loopback, link-local (including `169.254.169.254`), CGNAT and other special-purpose addresses, and logs every request. You can limit an organization to an allowlist of hosts.
- **Declared, not stealthy.** Requests are signed with [Web Bot Auth](https://developers.openwaf.dev/browsers/web-bot-auth/) by default so sites can tell an agent is visiting. There is no fingerprint spoofing, no residential proxy and no CAPTCHA solving. See [what it is not](https://developers.openwaf.dev/browsers/what-it-is-not/).
- **Hosted in the EU.** Browsers, recordings and logs stay in Germany.

## How it works

```text
agent ── API + CDP ──┐
person ── liveUrl ───┤
                     ▼
        browsers.openwaf.dev
                     ▼
    Chrome container (Germany)
                     ▼
 egress proxy (80/443, logged)
                     ▼
              public web
```

1. Your agent calls `POST https://browsers.openwaf.dev/v1/browsers` with a browser key (`bdk_…`).
2. The answer carries the browser `id` (`bs_…`), `cdpUrl`, `liveUrl` and `urlsExpireAt`.
3. The agent connects to `cdpUrl` and drives Chrome. Closing the CDP connection does not stop the browser.
4. The browser stops when you stop it, after 120 seconds with no CDP or live view client, after 60 minutes in total, or when Chrome exits. Its files stay available for 7 days.

Keys, usage, sessions, the egress log and settings are managed per organization from the dashboard (**Browsers**), the [OpenWAF API](https://developers.openwaf.dev/browsers/reference/#control-plane-api), the [CLI](https://developers.openwaf.dev/browsers/reference/#cli) or the [MCP server](https://developers.openwaf.dev/browsers/reference/#mcp-tools).

## Get access

1. Make sure every owner and admin of the organization has a verified email and [two-factor authentication](https://developers.openwaf.dev/fundamentals/account-security/) turned on. An operator checks this before approving.
2. In the dashboard, open **Browsers** in the organization menu. The **Overview** tab shows the requirements and a **Request access** button, which opens an email to support@openwaf.dev with your organization id. You can also write to support@openwaf.dev directly.
3. When an operator approves the organization, the **Overview** tab shows your quota and an admin can create the first key.


Until then, `GET /v1/orgs/{org}/browsers` answers with `"status": "not_enabled"` and the writes answer `403 feature_disabled`.

## Next steps

- [Quickstart](https://developers.openwaf.dev/browsers/quickstart/): create a key, start a browser and drive it with Playwright, Puppeteer or MCP.
- [API reference](https://developers.openwaf.dev/browsers/reference/): data plane, control plane, CLI and MCP tools.
- [Limits and quotas](https://developers.openwaf.dev/browsers/limits/): browser-hours, egress, concurrency, timeouts and retention.
- [Web Bot Auth](https://developers.openwaf.dev/browsers/web-bot-auth/): how sites identify the agent, and how to verify it.
- [What it is not](https://developers.openwaf.dev/browsers/what-it-is-not/): no stealth, no spoofing, no CAPTCHA solving.